Extracted

• • Target

    EpicInstaller-17.2.0.msi

  • Size

    194.0MB

  • MD5

    392f66528c31a402484379f57d0605a1

  • SHA1

    40d155146d49258d3f3e3d8bacc6c919ad8c1d35

  • SHA256

    bdb77e87b9d666634e182ea42482d9559125ca8e62c2399b8ad2c6b42395aaa8

  • SHA512

    24924b00dc61295ff9fd8f003addaa2f56e6774d2b6e20c068d0d538f0c2b1e2af9c6ca117b9718513218734596a93540e8674294ec67ea91f4dec865b473600

  • SSDEEP

    3145728:HyCHcktJLbo4ZW0AF7PPMQxSkn2XbtOk1Ne4rkq//id544fVHBo9LE5XCJuo:Tc81WtsXk2XbcPdij4cJE5XC

  Score

  10^/10

  lummamicrosoftdiscoverypersistencephishingprivilege_escalationspywarestealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Detected potential entity reuse from brand MICROSOFT.

    phishingmicrosoft
  behavioral1